Horizon uses a separate sub-domain with its own set of cookies to protect against session hijacking #126
pratikshap31
started this conversation in
General
Replies: 2 comments
-
Is someone facing the same issue? |
Beta Was this translation helpful? Give feedback.
0 replies
-
@paras-malhotra |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I am getting session cookies domain error while running the enlightn package.
Check 92/126: Horizon uses a separate sub-domain with its own set of cookies to protect against session hijacking. Failed
While Horizon is currently using a separate domain, your application session cookies are still shared with Horizon. This exposes your application to session hijacking, where if either your main application or Horizon is compromised, then the other would also be compromised. It is recommended to configure separate cookies by setting the session domain configuration to null.
At config/session.php, line 158.
Documentation URL: https://www.laravel-enlightn.com/docs/security/horizon-security-analyzer.html
My application has multiple subdomains. each user has his own subdomain.
if I remove the URL and set null for session_domain it will return page 404 when i logged in to any user account
how to solve this ?
Beta Was this translation helpful? Give feedback.
All reactions